关键词: 分布式拒绝服务, 熵, 攻击检测

Abstract: Compared with the volume or feature based approaches, detecting Distributed Denial of Service (DDoS) attacks based on entropy has the following advantages: simple calculation, high sensitivity, low false positive rate, no need of additional network traffic and device. For the purpose of getting higher precision and lower false positive rate in contrast to traditional entropybased approaches, a Modified Entropy-Based (MEB) scheme was proposed in this paper, which divided DDoS attacks into different threat levels and treated each threat level with according method. The effeciency of this scheme was validated with simulation in NS-2.

Key words: Distributed Denial of Service (DDoS), entropy, attacking detection